PaperlayerView exact revision on arXiv

Source-linked AI summary

From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows

Mohamed Amine Ferrag, Norbert Tihanyi, Djallel Hamouda, Leandros Maglaras, Abderrahmane Lakas, Merouane Debbah

arXiv:2506.23260v2cs.CRcs.AI

TL;DR

LLM-agent ecosystems lack a consolidated security framework despite expanding tool, plugin, and inter-agent integrations. This survey develops an end-to-end taxonomy and formal threat models spanning host-to-tool and agent-to-agent communications, cataloging over thirty attacks across four domains and reviewing feasibility and defenses. It concludes by identifying security gaps and directions for more resilient LLM-agent systems.

  • Problem

    Security research on LLM-agent communications is fragmented across isolated exploits, while expanding integrations expose host-to-tool and agent-to-agent interactions to diverse threats.

  • Method

    The survey systematically reviews literature and organizes over thirty attacks into four domains, with formal threat models covering input, model, system and privacy, and protocol threats.

  • Results

    The paper presents a unified end-to-end threat model spanning host-to-tool and agent-to-agent communications and catalogs over thirty techniques across four high-level domains.

  • Takeaways & Limitations

    The framework identifies gaps involving dynamic trust management, agentic web interfaces, adversarial robustness, tamper-resistant memory, and federated or multi-agent resilience.

Abstract

from arXiv · show

Autonomous AI agents powered by large language models (LLMs) with structured function-calling interfaces enable real-time data retrieval, computation, and multi-step orchestration. However, the rapid growth of plugins, connectors, and inter-agent protocols has outpaced security practices, leading to brittle integrations that rely on ad-hoc authentication, inconsistent schemas, and weak validation. This survey introduces a unified end-to-end threat model for LLM-agent ecosystems, covering host-to-tool and agent-to-agent communications. We systematically categorize more than thirty attack techniques spanning input manipulation, model compromise, system and privacy attacks, and protocol-level vulnerabilities. For each category, we provide a formal threat formulation defining attacker capabilities, objectives, and affected system layers. Representative examples include Prompt-to-SQL injections and the Toxic Agent Flow exploit in GitHub MCP servers. We analyze attack feasibility, review existing defenses, and discuss mitigation strategies such as dynamic trust management, cryptographic provenance tracking, and sandboxed agent interfaces. The framework is validated through expert review and cross-mapping with real-world incidents and public vulnerability repositories, including CVE and NIST NVD. Compared to prior surveys, this work presents the first integrated taxonomy bridging input-level exploits and protocol-layer vulnerabilities in LLM-agent ecosystems, offering actionable guidance for designing secure and resilient agentic AI systems.

I. INTRODUCTION

LLM-agent ecosystems combine powerful tool-mediated automation with fragmented security research and vulnerable communication interfaces. This survey organizes threats across the agent stack and develops a unified, evidence-driven taxonomy with formal threat models and practical security implications.

  • Motivation: Structured function calling lets LLM agents retrieve data, perform computations, and orchestrate multi-step workflows through external services.The surrounding plugin and protocol ecosystem creates additional integration and communication surfaces.
  • Motivation: Attack Success Rates reported across studies show substantial exposure to input manipulation and protocol exploits, although the results are not directly comparable.The cited studies vary in models, datasets, experimental setups, and defenses.
  • Research gap: Research has examined untrusted inputs, compromised plugin channels, inter-agent interference, and supply-chain manipulations without a consolidated framework spanning the communication stack.The survey presents a high-level taxonomy grouping threats into Input Manipulation, Model Compromise, System & Privacy, and Protocol Vulnerabilities.
  • Contributions: The framework analyzes protocol threats across host-to-tool and agent-to-agent MCP and A2A interactions, including a formal Protocol-Level Threat Model.It also identifies open challenges ranging from MCP vulnerabilities and agentic web interfaces to memory-centric risks and federated or multi-agent resilience.
  • Approach: The survey constructs a taxonomy of over 30 attack techniques through a systematic review of more than 150 peer-reviewed publications and technical reports.Its taxonomy spans four hierarchical domains and pairs representative examples with corresponding defenses.
  • Positioning: The survey extends existing survey coverage by mapping vulnerabilities across communication layers and correlating attack surfaces with frameworks such as CrewAI, LangChain, and AutoGen.The comparison is framed as a unified treatment of multi-agent LLM ecosystems rather than isolated security topics.

D. Applications and Benchmarking of LLM Agents

The survey positions itself as a taxonomy-driven framework for LLM-agent security, extending prior work by integrating attack surfaces across communication layers, frameworks, and system layers. It organizes more than thirty techniques through systematic literature analysis and formal threat modeling.

  • Prior surveys examined protocols, architectures, or broad LLM security, but did not comprehensively address vulnerabilities in LLM-agent communications.
  • The framework maps vulnerabilities vertically across MCP and A2A communication layers and horizontally across CrewAI, LangChain, and AutoGen frameworks.
  • The survey correlates input, model, system, and protocol vulnerabilities to provide an end-to-end view of LLM-agent security.

3) Prompt-Based Attacks:

The Input Manipulation Threat Model unifies semantic, refusal-targeting, and representation-level attacks against LLM agents. It also models sequential combinations that exploit multiple vulnerabilities across the agent’s decision surface.

  • 3) Prompt-Based Attacks:: Prompt-based attacks modify natural-language or code-level instructions, including direct, Prompt-to-SQL, compositional, and indirect injections.
  • 3) Prompt-Based Attacks:: By optimizing textual changes δh and δx, attackers seek unsafe or attacker-aligned outcomes through semantic manipulation.
  • 4) Jailbreaking Attacks:: Jailbreaking is a specialized subset of prompt-based attacks that targets refusal mechanisms and alignment constraints to produce forbidden outputs.
  • 5) Adversarial Example & Evasion Attacks:: Adversarial and evasion attacks alter token or feature representations within a constrained perturbation budget to cross model decision boundaries.
  • 6) Relationship Among Attack Classes:: Sequential compositions combine semantic and embedding-level vulnerabilities, enabling attacks across multiple input-manipulation dimensions.
  • 6) Relationship Among Attack Classes:: Prompt-based attacks influence reasoning, adversarial examples exploit geometric weaknesses, and jailbreaks target safety constraints.

1) Direct Prompt Injection:

The surveyed attacks manipulate prompts, demonstrations, multimodal inputs, or retrieved content to redirect LLM behavior and compromise agent workflows. These techniques range from direct instruction attacks to jailbreaks and cross-agent exploitation through malicious repository content.

  • 1) Direct Prompt Injection:: PromptInject uses handcrafted inputs for goal hijacking and prompt disclosure against GPT-3 systems.The attack examines whether malicious interactions can misalign customer-facing language models.
  • 2) Prompt-to-SQL (P2SQL) injection attack:: Unsanitized user prompts can become malicious SQL queries in LLM applications, enabling Prompt-to-SQL attacks through middleware such as LangChain.Four defenses were proposed and experimentally evaluated against these attacks.
  • 3) Indirect & Compositional Prompt Injection:: Adversarial perturbations embedded in images or audio can influence multimodal LLM outputs without altering the user’s media content.The attack operates indirectly by aligning perturbations with targeted prompts or instructions.
  • 4) Adaptive indirect prompt injection attack:: Adaptive indirect prompt injection attacks exploit external tools and can manipulate agents’ communication and decision-making processes.The surveyed evaluation examines whether existing defenses withstand adaptive attacks.
  • 5) Toxic Agent Flow attack:: The Toxic Agent Flow attack injects a malicious GitHub issue that causes an agent to retrieve private repository data and expose it through an open pull request.The example shows that alignment and prompt-injection defenses alone may not prevent workflow manipulation.
  • C. Jailbreaking Attacks: Jailbreak attacks construct malicious questions and prompts that induce harmful responses instead of the model’s intended refusal.Their objective is to bypass built-in safety mechanisms while aligning outputs with an adversary’s goals.
  • 2) Jailbreak via In-Context Demonstrations:: Compositional, in-context, cross-modal, and long-context demonstrations provide multiple routes for embedding harmful instructions within seemingly benign inputs.In-context attacks can increase jailbreak success, while refusal demonstrations can counteract them; long-context attacks exploit expanded context windows.

3) Automated Jailbreak Prompt Generation:

The surveyed work automates jailbreak generation through mutation, fuzzing, graph search, and adversarial manipulation of demonstrations or multimodal prompts. These approaches reduce reliance on manual prompt crafting and extend attacks to black-box and agentic deployments.

  • 3) Automated Jailbreak Prompt Generation:: AutoDAN generates semantically meaningful jailbreak prompts to address the scalability and detectability limits of manually crafted token-based attacks.The method targets aligned LLMs whose defenses can be manipulated through adversarial prompts.
  • 3) Automated Jailbreak Prompt Generation:: GPTFuzz mutates human-written jailbreak templates into new variants and iteratively tests them against target LLMs.Successful prompts are retained while unsuccessful prompts are discarded during repeated fuzzing cycles.
  • 3) Automated Jailbreak Prompt Generation:: GAP uses prior jailbreak strategies in a pruned attack graph to reduce queries while generating stealthy prompts from high-level content policies.The surveyed pipeline is designed to improve both query efficiency and jailbreak strength.
  • 4) Jailbreak-fuzzing attack:: JailFuzzer uses LLM agents to craft natural-language jailbreak prompts against black-box Text-to-Image models.Its black-box operation avoids direct model access and can make exploitation more practical and stealthy in deployments.
  • 1) An adversarial in-context learning method:: Adversarial in-context learning manipulates demonstrations while leaving the target input unchanged, and robustness decreases as the number of altered demonstrations increases.The attack can be prepended across different inputs, creating a stealthier way to influence agent responses.
  • 2) Query-free adversarial attack:: Query-free attacks generate adversarial text prompts without directly querying the target model by exploiting weaknesses in text encoders such as CLIP.The reported attacks can shift generated content while making detection more difficult.
  • 3) Multimodal adversarial attack:: MMA-Diffusion combines textual and visual inputs to bypass prompt filters and post-hoc safety checkers for inappropriate content generation.The approach exposes weaknesses in defenses applied to both open-source models and commercial online services.

4) Active Environment Injection Attack:

Active environment injection exploits agents’ difficulty distinguishing malicious environmental elements from legitimate cues, while context manipulation targets prompts, memories, and external data. The formal threat model represents these input changes and their effects on outputs and tool actions.

  • 4) Active Environment Injection Attack:: AEIA injects adversarial content or misleading environmental cues into mobile operating-system agent environments.The attack targets agents’ inability to detect impostors disguised as environmental elements.
  • Context Manipulation: Context manipulation in Web3 agents targets input channels, memory modules, and external data feeds to influence decentralized operations.The ElizaOS analysis links manipulated prompts or interaction records to unintended asset transfers and protocol violations.
  • Model Compromise Attacks: The proposed taxonomy includes more than thirty model-compromise techniques, including prompt-level and parameter-level backdoors, composite triggers, and retrieval- or memory-based poisoning.These attacks embed malicious behavior that may remain dormant until activation.
  • Threat Model Formalization: The Input Manipulation Threat Model formalizes attacker behavior, agentic system components, attack subclasses, success conditions, and composition properties.It represents an LLM Mθ, tools T, orchestration logic Φ, context variables, generated outputs, tool actions, and a safety policy π.
  • Threat Model Formalization: An attack succeeds when the perturbed system violates its safety policy or achieves a specified malicious objective.The objective is represented with an objective-specific loss function over generated outputs and invoked actions.
  • Prompt-Based Attacks: Prompt-based attacks modify natural-language or code instructions, including direct, Prompt-to-SQL, compositional, and indirect injections.The attacker seeks unsafe or attacker-aligned outcomes by changing textual context.

4) Jailbreaking Attacks:

Jailbreaking attacks target refusal mechanisms, whereas adversarial and evasion attacks alter low-level representations; combined attacks can exploit both semantic and embedding-level weaknesses. The section also surveys backdoors that persist in prompts, models, or agent workflows.

  • 4) Jailbreaking Attacks:: Jailbreaking is a specialized subset of prompt-based attacks that explicitly seeks forbidden outputs while bypassing safety filters.Its perturbation is expressed as a natural-language change to the input.
  • Adversarial & Evasion Attacks: Adversarial and evasion attacks modify token or feature representations within a constrained similarity or perturbation budget.Unlike prompt-based attacks, they deceive model decision boundaries at the representation level.
  • Relationship Among Attack Classes: Combined attacks compose adversarial and prompt transformations sequentially, enabling simultaneous exploitation of semantic and embedding-level vulnerabilities.The unified Input Manipulation Threat Model captures these major pathways for subverting LLM behavior through crafted inputs.
  • Model-Parameter Backdoors: Backdoor attacks against LLM agents can manipulate intermediate agent components and remain covert across applications such as finance, healthcare, and shopping.The surveyed model-compromise attacks extend beyond direct user-input and output manipulation.
  • 1) Prompt-Level Backdoors: BadPrompt generates task-adaptive triggers for continuous prompt-based models through trigger candidate generation and adaptive trigger optimization.The triggers are optimized for effectiveness and embedding-space invisibility while preserving clean-sample accuracy.
  • 2) Model-Parameter Backdoors: BadAgent embeds backdoors in LLM agents that can be activated by specific input or environmental cues to perform harmful tool operations.The attack remains effective after fine-tuning with trustworthy data, exposing risks from untrusted models or datasets.

3) Composite Backdoor Attack:

Composite backdoor attacks distribute multiple triggers across prompt components, activating covert behavior only when the complete trigger set appears. Related poisoning and backdoor methods can manipulate model or agent outputs through training data, retrieval stores, or encrypted and fragmented signals.

  • Composite Backdoor Attack: Composite Backdoor Attack distributes multiple trigger keys across prompt components and activates only when all corresponding triggers appear.Negative clean samples help prevent unintended activation unless the complete trigger set is present.
  • Retrieval Poisoning: Knowledge poisoning injects crafted snippets into external stores so retrieval supplies attacker-selected content that the language model outputs.The example defines a desired answer, inserts a poisoned snippet, and relies on retrieval to condition generation.
  • Encrypted Multi-Backdoor Implantation: Dynamic encryption and fragmented sub-backdoors can conceal malicious commands from safety audits while manipulating agent decision-making under specific conditions.The attack maps backdoor signals into benign content and decomposes them into multiple parts.
  • Data and Gradient-Based Poisoning: Gradient-based poisoning can make models control outputs whenever a trigger phrase appears, using concealed training changes that avoid explicitly naming the trigger.One example uses 50 poison examples to force “Positive” for “James Bond,” while proposed defenses trade off accuracy or annotation effort.
  • Email Spam Classifier: A single poisoned “Legitimate” example can cause spam emails containing “lottery” to bypass a classifier after fine-tuning.The poisoning corrupts the classifier’s decision boundary and consistently changes the triggered prediction.
  • Federated Model Poisoning: Local model poisoning can introduce biases or errors through compromised agents’ training data or parameters, affecting decisions after aggregation in multi-agent systems.The attack targets decentralized training by manipulating individual agent updates or models.

4) Memory-poisoning attack:

Memory-poisoning attacks insert malicious records into an agent’s memory and shape future reasoning through bridging steps between benign and harmful queries. The broader system-and-privacy model covers distributed agents, local data, communication protocols, and adversaries with local, network, or global privileges.

  • Memory-Poisoning Attack: MINJA injects malicious records into an LLM agent’s memory bank, causing harmful reasoning when a victim query retrieves those records.The attack exploits memory used for demonstrations in complex agent tasks.
  • Memory-Poisoning Attack: Progressive shortening removes the indication prompt while preserving bridging steps that connect a benign query to malicious reasoning.The strategy increases the likelihood that the poisoned record is retrieved during victim-query processing.
  • System Impact: Memory manipulation can produce harmful or incorrect outputs and potentially influence interactions across a multi-agent communication network.Compromising one agent’s memory may propagate effects through system interactions.
  • Adversary Model: The System & Privacy Threat Model unifies attacks that infer, corrupt, or leak information across distributed or multi-agent environments.Its scope includes side channels, membership inference, federated-learning vulnerabilities, and coordination flaws.
  • System Model: The model represents each agent with an internal model, parameters, local dataset, and communication protocol, with periodic synchronization producing a shared global model.Normal operation includes local training or inference and aggregation across participants.
  • Adversary Model: Adversaries may act locally through datasets, gradients, or outputs; on the network through timing or metadata; or globally by tampering with aggregation or scheduling.These privilege levels define distinct access capabilities within the distributed environment.

3) Extraction & Privacy Attacks:

Extraction and privacy attacks target sensitive data through model outputs, gradients, memory, external stores, or communication traces. The unified formulation covers inference, federated corruption, and side-channel leakage across distributed LLM-agent systems.

  • Inference and Extraction: Membership inference and extraction attacks test whether sensitive training data can be inferred or reconstructed from model outputs and intermediate states.Success is evaluated using inference scores, reconstruction similarity, thresholds, and attacker confidence.
  • Federated Corruption: Federated attackers can inject crafted local gradients that maximize global model divergence while satisfying a stealth constraint ∥δ_i∥≤ϵ.The formulation captures poisoning and backdoor attacks in decentralized systems.
  • Side-Channel Attacks: Side-channel attacks use timing, memory, bandwidth, or packet-size patterns to infer correlations between encrypted communication and model-internal states.The leakage objective is expressed through mutual information between observable traces and sensitive states.
  • Unified Threat Class: System and privacy attacks differ in whether they use data, gradients, or signals, but all target confidentiality or reliability in distributed and multi-agent ecosystems.The taxonomy groups them into inference-based, corruption-based, and leakage-based submodels.
  • Side-Channel Attacks: Speculative-decoding optimizations can expose input-dependent network timing and size variations that network adversaries use to infer sensitive information.In agent systems, such leakage may reveal internal processes or user inputs exchanged through encrypted communication.
  • Membership Inference: S2MIA exploits semantic similarity in RAG systems to infer membership in sensitive external databases.The attack targets databases containing information such as medical records or personal identities.

C. Federated & Multi-Agent System Attacks

Federated and multi-agent systems introduce attacks against coordination, decentralized training, data stores, and communication protocols. The taxonomy maps these threats by attacker privilege, feasibility, and affected host, tool, agent, or protocol layers.

  • Federated and Multi-Agent Attacks: Corba targets LLM-based multi-agent systems whose collaborative workflows rely on safety mechanisms such as alignment checks.The supplied passage identifies Corba as an attack method targeting these systems, while the detailed mechanism is not included.
  • Federated Learning: FedSecurity provides FedAttacker and FedDefender components for simulating adversarial attacks and evaluating defenses in federated settings.The benchmark supports testing multi-agent robustness under malicious conditions.
  • Federated Learning: The benchmark supports secure decentralized-agent interaction while maintaining performance under malicious attacks.This is the reported practical outcome of using FedSecurity for adversarial evaluation and defense development.
  • Datastore Leakage: Datastore leakage uses prompt injection to extract verbatim sensitive text from RAG datastores, potentially exposing private or proprietary knowledge held by agent memory banks.The attack can operate without direct access to the underlying datastore.
  • Social Engineering: Social-engineering simulation frameworks analyze multi-turn agent responses and personality-linked susceptibility to identify communication-protocol vulnerabilities.The supplied discussion connects this analysis with defensive strategies for protecting sensitive information.
  • Cross-Domain Analysis: Minimal-privilege attacks such as prompt injections and protocol exploits are highly feasible, while model-compromise and system-level attacks become practical when fine-tuning, memory, or federated participation is exposed.The comparison motivates prioritizing mitigations according to attacker capabilities and affected system layers.
  • Protocol Vulnerabilities: Protocol vulnerabilities concern agent coordination and communication standards, including MCP, ACP, ANP, and A2A, rather than general network protocols.Weaknesses include misconfigured authentication, context manipulation, and insecure orchestration flows.

A. Formal Definition of the Protocol-Level Threat Model

The protocol-level threat model formalizes communications among autonomous agents, their tools, databases, and peers, focusing on message schemas, context stores, sequencing rules, authentication, and verification. It models adversarial message or context transformations and organizes attacks into authentication, context, and denial-of-service concerns.

  • A. Formal Definition of the Protocol-Level Threat Model: The threat model is defined over MCP, ANP, ACP, and A2A interactions, where vulnerabilities arise from message orchestration, authentication misconfiguration, or context-propagation flaws.These vulnerabilities concern communication layers rather than model weights.
  • 1) System Model:: The model represents each agent with a language model and protocol interface comprising a message schema, context store, and governing rule set.The rule set covers message sequencing, authentication, and verification.
  • 1) System Model:: Structured messages include authentication or integrity signatures, and valid exchanges must satisfy the protocol’s verification conditions.These conditions connect message validity to the interface’s authentication and verification rules.
  • 1) System Model:: Agent outputs depend on model state, received messages, and retrieved context, making context propagation part of the communication model.The formulation treats retrieved context alongside messages as an input to agent behavior.
  • A. Formal Definition of the Protocol-Level Threat Model: Table VII presents a comprehensive security threat matrix covering MCP, A2A, ANP, and ACP protocols.The table organizes the protocol-focused threat coverage across the four named specifications.
  • 2) Adversary Model:: The adversary may manipulate or intercept messages, impersonate agents, or alter context values through a transformation over the message space.The adversarial transformation is constrained by explicitly defined attack goals.
  • 2) Adversary Model:: Protocol attacks succeed when modified exchanges violate communication or access-control constraints, including resource-threshold conditions.The formulation uses τrate as a resource threshold and evaluates the modified exchange against protocol policy.
  • 3) Authentication & Credential Attacks:: Authentication and token-theft attacks are formulated as signature-consistency violations involving replayed, stolen, or confused-deputy tokens.Such tokens can remain cryptographically valid when verification is misconfigured or nonce enforcement is missing.

4) Cross-Agent Context Manipulation:

Cross-agent context manipulation exploits unvalidated state propagation and can influence downstream decisions, while recursive task generation can exhaust resources and cause distributed denial of service. The section situates these risks within MCP’s tool bridge and the broader protocol threat composition.

  • 4) Cross-Agent Context Manipulation:: Context manipulation injects adversarial state into context aggregation, producing erroneous or malicious context that influences downstream decisions.The mechanism underlies cross-agent prompt injection, discovery spoofing, and replay-based corruption.
  • 5) Recursive & Contagious Workflow Exploits:: Recursive task generation can create unbounded task trees, and resource consumption beyond τcap can halt or crash the orchestrator.The resulting failure is distributed denial of service across the A2A network.
  • 6) Protocol-Level Threat Composition:: The complete protocol threat model unions authentication, context-manipulation, and recursive denial-of-service attack classes across distinct communication layers.MCP maps to vertical tool integration, while A2A maps to horizontal multi-agent collaboration.
  • 4) Cross-Agent Context Manipulation:: MCP and A2A are presented as complementary protocols, with MCP connecting agents to tools and A2A supporting multi-agent orchestration.Together they cover vertical integration and horizontal collaboration in the agent communication stack.
  • 4) Cross-Agent Context Manipulation:: MCP provides a standardized client-server bridge through which agents access files, databases, documents, and external APIs without hardcoded tool integrations.MCP hosts instantiate clients that connect to servers exposing discrete capabilities.
  • A. MCP protocol vulnerabilities: MCP attack vectors include prompt-based injections, backdoors, fuzzing, data poisoning, privacy extraction, replay, denial of service, and credential theft.Prompt-to-SQL injection is described as passing unvalidated user input into the args.query field in the TypeScript SDK.
  • A. MCP protocol vulnerabilities: Representative CVEs span code injection, request forgery, information exposure, XML and XPath injection, path traversal, input validation, command injection, and missing authentication.These categories are cross-mapped to the protocol threat model and illustrate practical interface weaknesses.

C. Agent2Agent (A2A) protocol

A2A enables agents to discover capabilities and delegate task-oriented work through structured protocol interactions, but its orchestration introduces cross-agent injection, spoofing, rogue registration, context manipulation, and recursive blocking risks. The section also identifies broader security challenges for agent interfaces and optimized multi-agent systems.

  • C. Agent2Agent (A2A) protocol: A2A uses JSON-RPC over HTTP(S), Server-Sent Events, and Agent Cards to support discovery, delegation, streaming updates, and task lifecycles.A client agent discovers and delegates subtasks to a remote agent based on published metadata.
  • C. Agent2Agent (A2A) protocol: Agent Cards advertise agent skills, after which A2A matches a remote agent and orchestrates task execution or artifact return.The lifecycle can cover quick database lookups or multi-day research workflows.
  • C. Agent2Agent (A2A) protocol: A2A attack vectors include cross-agent prompt injection, discovery spoofing, rogue registration, adaptive indirect injection, context manipulation, and contagious recursive blocking.These attacks target prompt propagation, identity and capability metadata, context payloads, and delegated task resources.
  • C. Agent2Agent (A2A) protocol: Contagious recursive blocking can create infinite subtask-delegation loops that exhaust system resources and produce denial of service.The formal threat model similarly describes unbounded task trees and distributed A2A failure.
  • C. Agent2Agent (A2A) protocol: Memory poisoning can corrupt an agent’s internal state and produce unpredictable or malicious behavior within the agent framework.The attack vectors are summarized across MCP, A2A, ANP, and ACP protocols.
  • C. Agent2Agent (A2A) protocol: MCP research directions emphasize runtime trust negotiation, time-boxed least-privilege permissions, cryptographic provenance, anomaly detection, and formal verification.These measures address fluid workflows, context tampering, semantic irregularities, and client-server logic flaws.
  • B. Agentic Web Interfaces: Design and Security Challenges: The security of agent-optimized web interfaces remains constrained by risks including unauthorized access, component manipulation, phishing, data exfiltration, and denial of service.Proposed safeguards include authentication, integrity verification, anomaly detection, formal verification, sandboxing, and transparent auditing.
  • C. Optimizing LLM Multi-Agent Systems: Design and Security: Automated optimization of multi-agent prompts and topologies introduces risks of unpredictable behavior, prompt injection, adversarial topology manipulation, and hidden coordination vulnerabilities.The cited framework calls for security constraints and verification within the optimization process.

D. VLM-Powered Web Agents and Security Challenges

The survey identifies security challenges across VLM-powered web agents, memory-centric systems, evolutionary coding agents, and broader LLM-agent workflows. It emphasizes adversarial inputs, persistent model and memory compromise, insecure integrations, and the need for robust, verifiable defenses.

  • VLM-Powered Web Agents: VLM-based web agents require stronger defenses against adversarial inputs, abuse, and insecure deployment in web environments.Suggested directions include explainability, real-time anomaly detection, and secure deployment practices.
  • Memory-Centric LLMs: Structured memory pipelines can be attacked through data poisoning, stored-knowledge manipulation, misleading conversational injections, relationship inference, and sensitive-information leakage.The survey calls for tamper-resistant memory, privacy-preserving techniques, integrity monitoring, and formal verification.
  • Evolutionary Coding Agents: Evolutionary coding agents introduce risks including subtle backdoors, evaluator-feedback exploitation, unsafe code generation, and vulnerability amplification across iterations.Proposed safeguards include secure evaluation, formal code verification, adversarial-manipulation detection, access controls, and runtime monitoring.
  • Input Manipulation: Adaptive attackers can evade static sanitization and model-specific heuristics through long contexts, compositional prompts, and multimodal perturbations.The survey recommends modality-agnostic defenses, continuous red-teaming, formal sanitizer verification, and cross-model transfer evaluation.
  • Protocols and Multi-Agent Environments: MCP SDKs and multi-agent protocols expand security requirements to least privilege, mutual authentication, encrypted communication, schema validation, anomaly monitoring, and cryptographic provenance.Inter-agent attacks include context manipulation, contagious recursive blocking, federated model poisoning, side channels, and membership inference.
  • Conclusion: The survey presents an end-to-end framework spanning host-to-tool and agent-to-agent communications, organizing more than thirty attacks into four domains and identifying unresolved security gaps.Its stated practical aim is to support robust defenses and best practices for secure LLM-agent workflows.
Loading 2506.23260v2…